Senior Apple Platforms Engineer

Role Summary

The Apple Engineer IV is the senior technical lead for enterprise Apple platforms (macOS, iOS/iPadOS, tvOS) across the district.

This role designs, automates, and governs large-scale endpoint management, security baselines, and zero-touch provisioning for tens of thousands of Apple devices used by students, teachers, and staff.

The Engineer IV is a hands-on architect, mentor, and cross-functional partner who drives reliability, security, and user experience at scale.

Key Outcomes (First 12 Months)

Zero‑touch provisioning: 95%+ of new Apple devices enrolled via automated workflows (DEP/ASM Apple School management), with policy compliance in

Security baseline: CIS-aligned macOS profile deployed district-wide with measurable compliance >90% and FileVault coverage >98%.

App delivery reliability: Package/patch pipeline with rollback and health checks; 95th percentile install success >97% across sites.

Observability: Unified telemetry for macOS/iOS (MDM, logs, fleet metrics); actionable dashboards for compliance, patch, and incidents.

K–12 readiness: Shared iPad and Apple Classroom enabled where applicable; app licensing via ASM Apps & Books streamlined.

Responsibilities

• Platform Architecture & Governance: Design and maintain enterprise Apple management architecture (Jamf Pro and/or Intune), including enrollment, scoping, smart groups, device compliance policies, and remediation automation.

• Automation, Packaging & Release Engineering: Build CI/CD for Apple packages, scripts, and profiles using AutoPkg, Jamf/Intune APIs, and Git workflows.

• Security, Identity & Compliance: Implement and monitor FileVault, Gatekeeper, XProtect, SIP, PPPC/TCC, and privacy controls.

• Operations & Reliability: Lead Tier‑4 incident response and problem management for complex Apple issues; drive RCAs and corrective actions.

• Instructional Technology & User Experience (K–12): Enable Shared iPad, Apple Classroom, and app catalog experiences tailored to grade levels and accessibility needs.

• Vendor & Stakeholder Management: Serve as technical owner with Apple, Jamf/Microsoft, and hardware OEMs; evaluate releases and advisories.

Qualifications — Required

• 7+ years architecting and operating large-scale Apple environments (10,000+ endpoints), including macOS and iOS/iPadOS.

• Deep expertise with an enterprise MDM (Jamf Pro and/or Microsoft Intune), Apple School Manager, and Managed Apple IDs.

• Strong macOS internals and administration (profiles, LaunchDaemons/Agents, unified logs), and iOS supervision/MDM payloads.

• Scripting proficiency (bash/zsh, Python; familiarity with REST APIs and JSON; PowerShell for Intune as needed).

• Security baseline implementation (FileVault, PPPC/TCC, certificates/PKI), CIS macOS benchmarks, and compliance reporting.

• Experience in K–12 or similar multi‑site public sector environments with strict privacy and instructional continuity needs.

• Proven leadership: mentoring engineers/techs, leading RCAs, authoring standards, and executing cross‑org change.

Qualifications — Preferred

• Jamf certifications (200/300/370) or equivalent mastery; Apple Platform certifications (current Apple Device Support/Management).

• Microsoft MD‑102 (Endpoint Administrator) or equivalent Intune expertise.

• Experience with AutoPkg/AutoPR, SwiftDialog, Munki, Notarization/Stapling, and package signing.

• Knowledge of NIST 800‑53/171, CIS Controls, Zero Trust principles, and EDR tooling on macOS.

• Familiarity with Azure AD/Entra ID SSO for macOS, Kerberos SSO extension, and modern identity for Apple endpoints.